FortiSwitch vulnerabilities

5 known vulnerabilities in FortiSwitch from Fortinet. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  FortiSwitch: Unverified Password Change

  CVE-2024-48887Apr 8, 2025FortinetEPSS 15.7%

  A unverified password change vulnerability in Fortinet FortiSwitch GUI may allow a remote unauthenticated attacker to change admin passwords via a specially crafted request

• 9.8 Critical severity

  FortiSwitchManager: Buffer Underwrite

  CVE-2023-25610Mar 24, 2025FortinetEPSS 18.3%

  A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.6, version 6.4.0 through 6.4.11 and version 6.2.12 and below, FortiProxy version 7.2.0 through 7.2

• 7.8 High severity

  FortiSwitch: Improper Neutralization of Special Elements used in an OS Command

  CVE-2023-37937Jan 14, 2025Fortinet

  An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSwitch version 7.4.0 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.7 and 6.4.0 through 6.4.13 and 6.2.0 through 6.2.7 and 6.0.0 through 6.0.7 allows

• 9.8 Critical severity

  FortiSwitch: Use of Hard-coded Credentials

  CVE-2023-37936Jan 14, 2025Fortinet

  A use of hard-coded cryptographic key in Fortinet FortiSwitch version 7.4.0 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.7 and 6.4.0 through 6.4.13 and 6.2.0 through 6.2.7 and 6.0.0 through 6.0.7 allows attacker to execute unauthorized code or commands via cr

• 8.8 High severity

  FortiVoice: Cross-Site Request Forgery

  CVE-2022-27488Dec 13, 2023Fortinet

  A cross-site request forgery (CSRF) in Fortinet FortiVoiceEnterprise version 6.4.x, 6.0.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 through 6.4.10, 6.2.0 through 6.2.7, 6.0.x, FortiMail version 7.0.0 through 7.0.3, 6.4.0 through 6.4.6, 6.2.x, 6.0.x Forti